Sandboxie Support

Re: SandboxieReflector - cross-sandbox execution

2014-07-22T22:48:57-04:00

Would it be possible for the people that got SandboxieReflector running successfully with an app either sandboxed in another sandbox or running outside any sandbox share some detailed information on the steps to achieve this?

Even though I am at times coding away little sites as a past time I find the little documentation too steep to follow as of now, even though I have been digging into it and got a few minor results already.

I guess js, $, html5 and such do not have that much to do with dos and shell and the registry so a completely different area really.

I am not interested in security breaches or any malicious activity, on the contrary I would love to be able to have Office and Email and Browser "talk" to each other, either all sandboxed individually or just the browser and email and, unfortunately as it stands now I will have to accept that Office will need to be run from the drive, unsandboxed.

Help in this area would not only be appreciated by myself looking at the many topics of people that like to run certain apps in individual sandboxes or outside of a sandbox.

Even pointing to good learning resources, tuts, links or helping topics about how to get SandboxieReflector to run (I guess learning dos and shell commands??) or how to get it to communicate with apps would be tremendously appreciated.

I am not looking for a solution served ready made, NO, happy to learn this myself but would love at least for some guidance or feedback or ideas shared.

Thanks to anyone that feels to chip in here.

Statistics: Posted by JohnBox — Tue Jul 22, 2014 10:48 pm

Thank you, Carl

2012-07-10T18:12:42-04:00

Carl, I wished to thank you for SandboxieReflector.

It has enabled me to find a secure way for my wife to use a sandboxed Firefox browser while ensuring she automatically calls forth Trusteer Rapport functionality (not available sandboxed) in an unsandboxed browser when clicking in sandboxed Firefox for various sensitive sites she accesses regularly. [Full details, should you be interested: http://www.sandboxie.com/phpbb/viewtopi ... 1977#81977].

Mine is perhaps an unorthodox use of your utility, but I believe with good intention.

Thank you, particularly for your simple and clear instructions that someone only familiar with some programming fundamentals was eventually able to apply with great success to obtain the result required.

Statistics: Posted by discs — Tue Jul 10, 2012 6:12 pm

SandboxieReflector - cross-sandbox execution

2012-04-28T18:13:54-04:00

Thanks a lot for this utility. I was looking for something like this for a long time. It helps me a lot, and it would help me even more if I were a more knowledge user (I am trying to open eml files in the Windows Live Mail's sandbox but the "/eml:" parameter makes me mad because the file path is always taken with two double quotes).

But I have experimented some Effectuator crashes. http://www.sandboxie.com/phpbb/viewtopic.php?t=12848

Thanks MichaelS for recommending "Default Programs Editor" too.

Statistics: Posted by Wepver — Sat Apr 28, 2012 6:13 pm

SandboxieReflector - cross-sandbox execution

2012-03-20T12:51:20-04:00

Thank you for the useful updates.

Statistics: Posted by MichaelS — Tue Mar 20, 2012 12:51 pm

SandboxieReflector - cross-sandbox execution

2012-03-20T09:10:39-04:00

Hi all,

A slight update for something I got fed up with real quickly: SandboxieReflector now automatically reloads it's settings is you change the settings file. Should save you some hassle with continuously restarting the Effectuator each time you're adding new profiles

Statistics: Posted by Carl Colijn — Tue Mar 20, 2012 9:10 am

SandboxieReflector - cross-sandbox execution

2012-03-13T09:14:39-04:00

Update: I've ignored my own advise, and added simple DDE support to SandboxieReflector. This will allow you to also reflect file and protocol associations which rely on DDE to transfer the correct data to the receiving app. Note that setting this up will not be as easy as setting up simple command line reflecting, so it's probably only for the more experienced users.

I didn't want to spend a lot of time on this and thus I resorted to a hack (for the DDE insiders: I just pass on the WM_DDE_INITIATE message unmodified from the Reflector to the target app and be done with it), so I do not know if it will work all the time on all platforms. It does work on Windows XP though.

Statistics: Posted by Carl Colijn — Tue Mar 13, 2012 9:14 am

Re: Small command I would like

2012-03-11T10:32:18-04:00

Carl Colijn wrote:
Messmer wrote:Can you add /min to the Effectuator so it go small on start.
Hi Messmer,

It's already there It's the /s switch.

Great, it solved one my problem. Software I wan't to use but with highly restrictive right on install.

Statistics: Posted by Guest — Sun Mar 11, 2012 10:32 am

Re: Small command I would like

2012-03-11T07:40:53-04:00

Messmer wrote:Can you add /min to the Effectuator so it go small on start.

Hi Messmer,

It's already there It's the /s switch.

Statistics: Posted by Carl Colijn — Sun Mar 11, 2012 7:40 am

Small command I would like

2012-03-10T17:16:40-04:00

Can you add /min to the Effectuator so it go small on start.

Statistics: Posted by Guest — Sat Mar 10, 2012 4:16 pm

SandboxieReflector - cross-sandbox execution

2012-03-02T17:22:06-04:00

Thank you for the improvements! This surely broadens the use of SandboxieReflector.

Statistics: Posted by MichaelS — Fri Mar 02, 2012 4:22 pm

SandboxieReflector - cross-sandbox execution

2012-03-02T06:47:20-04:00

MichaelS wrote:
Carl Colijn wrote:But I still do think my solution will also help you;
[...]
Does this do what I think you meant? It is a (potentially) useful and quick-to-add addition in it's own right, though, so I'd probably add it anyway. Another use case would be to consolidate multiple almost-similar cmdlines into one profile (like some programs have when they have multiple shell verbs), with the differences triggered via alternate Reflector.exe calls.
No doubt, what you presented would be a welcomed addition.

Thank you!

And thus came version 12.3.2; you can download it from the SandboxieReflector web page on my site (see the initial post).

The previous version could only handle a single /file parameter (reflected in any %1 CmdLine tag), but now you can use a more general /p parameter passing method, which allows you to create as many parameters as you want. Now on to investigating simple DDE proxying again... Did I tell you I wanted to leave it at version 12.2.22?

Statistics: Posted by Carl Colijn — Fri Mar 02, 2012 5:47 am

SandboxieReflector - cross-sandbox execution

2012-03-01T08:41:41-04:00

Carl Colijn wrote:I get what you're after, but I do not want to add a "raw" interpretation to SandboxieReflector - if such an interpretation would be added, anyone could execute any command in a sandbox, as long as they know the name of the corresponding profile.

Yes, I realize this, that's why I initially suggested to add an alternative version of the Reflector and/or Effectuator that allows the Reflector to pass raw command lines to the Effectuator, so only those who are aware of the risks would use it, but I understand the concern for security breaches.

Carl Colijn wrote:But I still do think my solution will also help you;
[...]
Does this do what I think you meant? It is a (potentially) useful and quick-to-add addition in it's own right, though, so I'd probably add it anyway. Another use case would be to consolidate multiple almost-similar cmdlines into one profile (like some programs have when they have multiple shell verbs), with the differences triggered via alternate Reflector.exe calls.

No doubt, what you presented would be a welcomed addition.

Thank you!

Statistics: Posted by MichaelS — Thu Mar 01, 2012 7:41 am

SandboxieReflector - cross-sandbox execution

2012-03-01T07:02:53-04:00

MichaelS wrote:Hello! Thank you for considering the suggestion.
Your approach is good, but the command would still depend on the CmdLine from the INI file, while a raw interpretation wouldn't.

Hi MichaelS,

I get what you're after, but I do not want to add a "raw" interpretation to SandboxieReflector - if such an interpretation would be added, anyone could execute any command in a sandbox, as long as they know the name of the corresponding profile. Since the SandboxieReflector.ini file is readable by anyone (even the baddies), this would mean a giant security breach. (as if like it's worthwhile to build circumvention code for all 10+ people on Earth using SandboxieReflector , but still...)

But I still do think my solution will also help you;

MichaelS wrote:An example. Let's say I run the following user command from my sandboxed file manager (which would replace $I, $R, $L with file paths or whatever):
CODE:
"C:\Program Files\SandboxieReflector\Reflector.exe" /exec  "D:\MyApp.exe" /I="$I" /R="$R" /L="$L" /Type=Mov /Notify="C:\Windows\Media\ding.wav"
In this case, the CmdLine property in SandboxieReflector.ini for the invoked profile could be null, like CmdLine="" and Effectuator.exe would run
CODE:
"D:\MyApp.exe" /I="$I" /R="$R" /L="$L" /Type=Mov /Notify="C:\Windows\Media\ding.wav"

In this case the Reflector.exe call would be:

CODE:

Reflector.exe /exec  /p I "$I" /p R "$R" /p L "$L" /p file "%1"

which would expand to e.g.:

CODE:

Reflector.exe /exec  /p I "inactive_pane_path" /p R "right_pane_path" /p L "left_pane_path" /p file "C:\Windows\Media\ding.wav"

The CmdLine in the .ini would be (now with the .wav supplied via Reflector as well via the "file" parameter):

CODE:

CmdLine="D:\MyApp.exe" /I="$I" /R="$R" /L="$L" /Type=Mov /Notify=$file

which in this case would expand to:

CODE:

CmdLine="D:\MyApp.exe" /I="inactive_pane_path" /R="right_pane_path" /L="left_pane_path" /Type=Mov /Notify="C:\Windows\Media\ding.wav"

Does this do what I think you meant? It is a (potentially) useful and quick-to-add addition in it's own right, though, so I'd probably add it anyway. Another use case would be to consolidate multiple almost-similar cmdlines into one profile (like some programs have when they have multiple shell verbs), with the differences triggered via alternate Reflector.exe calls.

Statistics: Posted by Carl Colijn — Thu Mar 01, 2012 6:02 am

SandboxieReflector - cross-sandbox execution

2012-02-29T13:18:00-04:00

Hello! Thank you for considering the suggestion.
Your approach is good, but the command would still depend on the CmdLine from the INI file, while a raw interpretation wouldn't.

An example. Let's say I run the following user command from my sandboxed file manager (which would replace $I, $R, $L with file paths or whatever):

CODE:

"C:\Program Files\SandboxieReflector\Reflector.exe" /exec  "D:\MyApp.exe" /I="$I" /R="$R" /L="$L" /Type=Mov /Notify="C:\Windows\Media\ding.wav"

In this case, the CmdLine property in SandboxieReflector.ini for the invoked profile could be null, like CmdLine="" and Effectuator.exe would run

CODE:

"D:\MyApp.exe" /I="$I" /R="$R" /L="$L" /Type=Mov /Notify="C:\Windows\Media\ding.wav"

or, if it is possible, introduce a /raw parameter whose value is concatenated to the ini CmdLine property (which can be null).

"C:\Program Files\SandboxieReflector\Reflector.exe" /exec /raw "D:\MyApp.exe" /I="$I" /R="$R" /L="$L" /Type=Mov /Notify="C:\Windows\Media\ding.wav"

Of course, the call is yours, and as I said before, I'm already using your applications in conjunction with one of mine to get the desired functionality.

Statistics: Posted by MichaelS — Wed Feb 29, 2012 12:18 pm

SandboxieReflector - cross-sandbox execution

2012-02-29T11:31:57-04:00

MichaelS wrote:Carl, I know you said you do not wish to improve or further extend your application, unless it's a bug-fix or vulnerability issue, and I completely understand if you do not want to implement the following suggestion:

Add an alternative version of the Reflector and/or Effectuator that allows the Reflector to pass raw command lines to the Effectuator, so it is not confined to the /file parameter.

Hi MichaelS,

A more generic method would be to pass all parameters along via a dedicated /p switch, with "/p file" a good replacement for the "/file" in use now. Something like:

CODE:

Reflector.exe /exec  [/p   [ ...]]

and the profile code something like:

CODE:

CmdLine=MyApp.exe [$ [$ ...]]

As an example:

CODE:

Reflector.exe /exec MyProfile /p file "%1",CmdLine=MyApp /open $file

and:

CODE:

Reflector.exe /exec MyProfile /p I "$I" /p R "$R" /p L "$L"CmdLine=MyApp /left_path=$L /other=$R /and_even=$I

Just like the Effectuator now looks for all %1's in the cmdlines and complains if there is an unmatch with any /file switch, it could just as easily compare all /p's in the same manner.

I'm already breaking my own promise of not improving the code by looking if initial DDE proxying support is easy to add, so the above would be a quick addition as well No promise on a time frame, but the idea intrigues me!

Statistics: Posted by Carl Colijn — Wed Feb 29, 2012 10:31 am